43 lines
1.6 KiB
TypeScript
43 lines
1.6 KiB
TypeScript
import { describe, expect, it } from "@suaveplan/testing/runner";
|
|
import { marshalRequest } from "../src/marshal-request/marshal-request.js";
|
|
|
|
describe("no-raw-request invariant", () => {
|
|
it("envelope contains no Request reference and JSON-serialises", {
|
|
timeout: 5000,
|
|
}, async () => {
|
|
const wire = await marshalRequest(
|
|
new Request("https://api.local/x", {
|
|
method: "POST",
|
|
headers: {
|
|
"content-type": "application/json",
|
|
authorization: "Bearer leak",
|
|
},
|
|
body: JSON.stringify({ a: 1 }),
|
|
})
|
|
);
|
|
const replaced = JSON.stringify(wire, (_k, v: unknown) => {
|
|
if (v instanceof Uint8Array) return { __u8: Array.from(v) };
|
|
return v;
|
|
});
|
|
// No "Request" prototype slipped in
|
|
expect(replaced.includes("Request")).toBe(false);
|
|
// No credentials cross the boundary
|
|
expect(replaced.toLowerCase().includes("authorization")).toBe(false);
|
|
expect(replaced.includes("Bearer leak")).toBe(false);
|
|
// The envelope is a plain object — no Request instance
|
|
expect((wire as unknown as object) instanceof Request).toBe(false);
|
|
});
|
|
|
|
it("exposed keys match the documented surface", {
|
|
timeout: 5000,
|
|
}, async () => {
|
|
const wire = await marshalRequest(new Request("https://api.local/"));
|
|
expect(Object.keys(wire).sort()).toEqual([
|
|
"body",
|
|
"headers",
|
|
"method",
|
|
"url",
|
|
]);
|
|
});
|
|
});
|